Terms & Privacy Policy

1. What Protogen Is

Protogen is an AI-powered wellness coaching platform designed to help users achieve their wellness goals by gamifying daily actions. Protogen is operated by Protogen, Inc., a Delaware C Corporation. Protogen is not a medical service and does not provide medical advice, diagnosis, or treatment. All recommendations are for general wellness purposes only. Always consult a qualified healthcare professional before making changes to your health routine.

2. Data We Collect

• Account information: email address and encrypted password
• Profile data: date of birth, biological sex, height, and weight
• Wellness goal: your selected focus area (longevity, performance, or aesthetics)
• Health documents: files you upload (lab results, medical records, supplement lists) — stored encrypted using a key you provide
• Genetic data: genomic files you voluntarily upload — stored encrypted using a key you provide, processed for wellness insights only
• Usage data: timestamps, protocol generation history, interaction logs, and website analytics, cookies, and similar technologies used to understand site traffic and marketing attribution
• Advertising measurement data: when you visit protogen.life, advertising pixels from Meta and TikTok may record your visit and clicks on our sign-up buttons, with your IP address, browser and device information, and cookie identifiers. When you create an account, we send Meta and TikTok a one-way hashed (SHA-256) copy of your email address and account ID, plus your IP address and browser user agent, so they can tell us whether our ads led to sign-ups.
  We never send them your actual email address, any contact information, any health documents, genetic data, profile health data, quests, or protocols (see Section 4a).

3. How We Use Your Data

• Generate personalized wellness protocols using AI analysis of your profile and uploaded documents
• Push notifications can show the names of your own quests on your lock screen; the iOS Show Previews setting (Settings > Notifications > Show Previews) controls whether they appear there
• Improve protocol quality based on aggregated, anonymized patterns (never individual data)
• Send transactional emails (verification codes, password resets) — no marketing emails
• Measure whether our advertising leads to sign-ups (see Section 4a)

3a. Legal Basis for Processing (GDPR)

We process your personal data on the following legal bases under GDPR Article 6 and Article 9:

You may withdraw consent for health document or genetic data processing at will. Withdrawal does not affect the lawfulness of processing before the withdrawal. To withdraw consent, delete the relevant files in your profile or contact privacy@protogen.life.

4. AI Processing (Third-Party Services)

Your profile data and uploaded documents may be sent to a configured third-party LLM provider API to generate wellness protocols. If you upload genetic data, selected genotypes from your genetic file are also sent, as described in Section 5; files recognized at upload as raw genetic data files are not sent whole.

4a. Advertising Partners

We use Meta Platforms, Inc. and TikTok to measure our advertising. They receive only the advertising measurement data described in Section 2 and process it under their own privacy policies (Meta, TikTok). Under some US state laws this may count as “sharing” personal information for advertising. We do not sell personal information for money.

To opt out, email privacy@protogen.life with the subject “Do Not Share Request”. The sign-up signal is sent once, at registration, so please send the request before you create an account. You can also limit website pixels through your browser’s cookie settings and the ad settings in your Meta and TikTok accounts.

5. Genetic Data

How we handle genetic data:

• Uploading genetic data is voluntary
• Genetic files are stored encrypted using the key you provide when you upload them
• When you generate a wellness protocol, our servers decrypt your raw genetic data file with that key and parse it. Genotypes for a curated set of wellness-related variants, and for additional variants the AI looks up, are sent to the third-party LLM provider described in Section 4 with their rsID, genotype, and chromosome position to produce wellness insights.
• A file recognized at upload as a raw genetic data file is not sent whole. Other uploads that contain genetic information, such as trait reports or raw genetic data in a format we do not recognize, are processed like other health documents, and their content can be sent to the LLM provider.
• Genetic data is never sold or shared with advertising partners
• Genetic insights are for general wellness purposes only and are not medical advice or a diagnostic test
• You can delete your genetic files from the Data Dashboard whenever you choose. Deletion removes the stored file; data already sent to the LLM provider cannot be recalled. Protocols and insights already generated from your genetic data can cite specific genes and genotypes; they are stored with your account, not encrypted with your key, and remain until you delete your account.

6. Data Storage and Security

Your uploaded health and genetic files are encrypted using a key you provide. Our servers receive your key when you upload, download, or process a file.

• All data is stored in MongoDB hosted on Google Cloud (us-central1 region)
• Passwords are hashed with bcrypt (cost factor 10) — we never store plaintext passwords
• Authentication uses JWT access tokens (30-day expiry) and rotating refresh tokens (90-day expiry) with reuse detection
• All connections use TLS encryption in transit
• Health documents and genetic files are encrypted with AES-256-GCM using a key you provide. Keep a secure copy of your key; losing it can prevent recovery of your uploaded files. When you generate a wellness protocol, your key is encrypted for transfer to a background worker. Current generation jobs remove their stored encrypted key when the job completes, fails, or is cancelled. Older job records and queued worker requests can retain encrypted keys until they are removed. Eligible document content, including genetic files, is decrypted on our servers for processing.

In the event of a personal data breach affecting your health or genetic data, we will notify you without undue delay and no later than 72 hours after becoming aware of the breach. Notification will be sent to the email address on your account and will describe: the nature of the breach, the data affected, the likely consequences, and the measures taken or proposed to address it. Where required by the FTC Health Breach Notification Rule, we will also notify the FTC within 60 calendar days of discovery.

7. Data Retention

Your data is retained as long as your account exists. You may request account deletion — this permanently removes your account and all associated data (protocols, documents, genetic files, usage history) from active systems. Residual copies in automated backups are purged within 30 days of deletion, after which no recoverable copy exists.

8. Your Rights

• Access: View all your data in the app (profile, documents, protocols)
• Correction: Update your profile data at will
• Deletion: Request full account deletion with cascade removal of all associated data
• Consent withdrawal: Revoke genetic data consent at will
• Data export: Request a copy of your data in machine-readable format (JSON) by contacting privacy@protogen.life
• Automated decision review: Request human review of AI-generated wellness protocols (see Section 11)
• Advertising opt-out: Ask us not to share your data with advertising partners (see Section 4a)
• Complaint: You have the right to lodge a complaint with your local data protection supervisory authority

9. Alpha Program

Protogen is currently in alpha testing. By creating an account, you acknowledge that:

• The platform is under active development and may change significantly
• Features may be added, modified, or removed without notice
• We may contact you for feedback about your experience
• The service is provided as-is with no uptime guarantees

10. Changes to This Policy

We may update this document as the platform evolves. Significant changes will be communicated via email or in-app notification. Continued use after changes constitutes acceptance.

11. Automated Decision-Making

Protogen uses AI to generate wellness protocols based on your profile, uploaded documents, and genetic data. These recommendations are produced by automated processing without individual human review before delivery.

You have the right to:

• Request a meaningful explanation of how a specific protocol recommendation was produced
• Request that a member of the Protogen team manually review an AI-generated recommendation before you act on it
• Object to a recommendation and request it be regenerated

To exercise these rights, contact privacy@protogen.life with the subject line “Protocol Review Request.”

12. Governing Law

These terms are governed by the laws of the State of Delaware, without regard to conflict of laws principles. Users located in the EU retain any mandatory rights to bring a claim before their local courts or supervisory authority where applicable.

13. Limitation of Liability

Protogen is provided “as is” during the alpha period. To the maximum extent permitted by applicable law:

• We make no warranties that the service will be uninterrupted, error-free, or fit for a particular purpose.
• Protogen is not liable for indirect, incidental, or consequential damages arising from your use of the service.
• Our total liability for claims arising out of these terms is limited to the amount you paid us in the 12 months preceding the claim (which, during the free alpha, is zero).

Nothing in this section limits liability for death or personal injury caused by our negligence, fraud, or other liabilities that cannot be excluded by law.

14. Acceptable Use

You agree not to:

• Use the platform to seek or obtain medical diagnoses, clinical decisions, or emergency health advice
• Upload documents belonging to another person without their explicit consent
• Attempt to reverse-engineer, scrape, or extract AI model outputs in bulk
• Share account credentials or allow others to access your account
• Use the platform in a manner that violates applicable law

We reserve the right to suspend or terminate accounts that violate these terms without notice.

15. Intellectual Property

The Protogen platform, including its design, AI models, and software, is owned by Protogen, Inc. Wellness protocols generated for you are provided for your personal use. You retain ownership of all documents and data you upload.

16. Account Termination

We may suspend or permanently terminate your account if:

• We reasonably believe your account has been compromised or is being used fraudulently
• You violate the Acceptable Use terms (Section 14)
• We discontinue the alpha program

In the event of termination, we will notify you by email and your data deletion rights under Section 8 remain in effect.

17. Contact

For privacy questions, data requests, or protocol review requests, contact us at: privacy@protogen.life

For general product support, account help, or bug reports, visit Support. For step-by-step privacy request instructions, visit Privacy Choices.